dbiel Posted June 3, 2006 Share Posted June 3, 2006 A lot of the spam getting into my inbox and missing the SpamCop filters contain links like the following: h t t p : //<Q||||>.looksonic.com Note: ignore the spaces added at the beginning of the line. I put them there. Link to comment Share on other sites More sharing options...
Farelf Posted June 4, 2006 Share Posted June 4, 2006 Thought I saw another post showing a (one) pair of pipe characters in the URL link, can't find it now. Maybe the pairs of pipes are a representation of the escape character - character 13 hex? Should think a couple of those would throw off the parsing but maybe Explorer ignores them? The application(s) you are using to reveal and copy might offer a clue to the technically savvy. Link to comment Share on other sites More sharing options...
bogbrush Posted June 6, 2006 Share Posted June 6, 2006 I don't think they actually repsesent anything. Pipe and less-than/more-than symbols aren't safe in URLs but they are valid, unparsed characters. In some cases the pipe symbol is used to pad out spoofed URLs, for example h t t p://www.microsoft.com=wsjfghwef=wef=wefwef=wefwef=ndh12|java.sun.com/ looks like a Microsoft URL in the status bar but is actually a sun.com URL. A lot of the spam getting into my inbox and missing the SpamCop filters contain links like the following: In your case I suspect it is designed for the purpose of fooling filters like SpamCop by preventing them from parsing URLs properly and therefore identifying and reporting them. Since you say it slipped through SpamCop I'd say it was working. Shutting down websites is a much more powerful tool against spammers than reporting individual zombie PCs from an army of tens of thousands so they will work hard to protect their sites from being identified. Link to comment Share on other sites More sharing options...
agsteele Posted June 7, 2006 Share Posted June 7, 2006 Shutting down websites is a much more powerful tool against spammers than reporting individual zombie PCs from an army of tens of thousands so they will work hard to protect their sites from being identified. But that's a matter of opinion that's been hotly debated here on many occasions Andrew Link to comment Share on other sites More sharing options...
btech Posted June 7, 2006 Share Posted June 7, 2006 A lot of the spam getting into my inbox and missing the SpamCop filters contain links like the following: h t t p : //<Q||||>.looksonic.com Note: ignore the spaces added at the beginning of the line. I put them there. Well, the question is: Do browsers recognize that information and load the site? Link to comment Share on other sites More sharing options...
Farelf Posted June 8, 2006 Share Posted June 8, 2006 Well, the question is: Do browsers recognize that information and load the site?And that's back to dbiel for the definitive answer unless others are seeing the same, JIC those really are "unprintable" ANSI/ASCII characters rendered somehow printable. Tust me, I've seen that happen before though admittedly only with specialized editing apps. But the world was younger then and standards/boundaries seemed a lot simpler. Link to comment Share on other sites More sharing options...
dbiel Posted June 8, 2006 Author Share Posted June 8, 2006 And that's back to dbiel for the definitive answer unless others are seeing the same, JIC those really are "unprintable" ANSI/ASCII characters rendered somehow printable. Tust me, I've seen that happen before though admittedly only with specialized editing apps. But the world was younger then and standards/boundaries seemed a lot simpler.The answer is IE 5.0 and 6.0 both render the site. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.